Distributed Authorization System: A Netflix case study Manish Mehta - PowerPoint PPT Presentation

Distributed Authorization System: A Netflix case study Manish Mehta - Chief Security Architect @ Volterra Torin Sandall - Co-founder of Open Policy Agent project - Software Engineer @ Velocity 2018 June 12-14

Manish Mehta Torin Sandall Senior Security Engineer @ Netflix Co-founder of the OPA project Chief Security Architect @ Volterra Software Engineer @ Styra manish@ves.io @sometorin Projects: @OpenPolicyAgent • Bootstrapping Identities Projects: • Secrets Management • Open Policy Agent • PKI • Kubernetes • Authentication • Istio (security SIG) • Authorization • Likes: Go, Quality, Good abstractions Velocity San Jose '18

Background - Definitions Transfer $1000 from Account X to Account Y Me My Bank 1. Verify the Identity of the Requester (Authentication or AuthN) 2. Verify that the Requestor is authorized to perform the requested operation (Authorization or AuthZ) These 2 steps do not need to be tied together !! Velocity San Jose '18

Background - Netflix Architecture Netflix Backend - Internal Resources Cloud Provider Resources Customer Partner Resources CDN Employee Velocity San Jose '18

Background - Netflix Architecture Netflix Backend - Internal Resources Cloud Provider Resources Customer Partner Resources CDN Employee Velocity San Jose '18

AuthZ Problem A (simple) way to define and enforce rules that read • Identity I • can/cannot perform • Operation O • on • Resource R • For ALL combinations of I , O , and R in the ecosystem. Velocity San Jose '18

Design Considerations Company Culture Implementation Languages •Freedom and Responsibility •Java, Node JS, Python, Ruby, … Resource Types Latency •REST endpoints, gRPC methods, •Call depth and Service rate SSH, Crypto Keys, Kafka Topics, … Flexibility of Rules Identity Types •Hard-coded structure vs. language-based •VM/Container Services, Batch Jobs, Employees, Contractors, … Capture Intent •Did you actually do what you think you did? Underlying Protocols •Don’t just trust, verify !! •HTTP(S), gRPC, Custom/Binary, … Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

High-level Architecture Application Ownership Build Manifest DB Policy DB Policy Employee Distributor Distributor Portal Aggregator Management System Service A AuthZ Agent Service B Distributor S Distributor Distributor App S Code H AuthZ Agent App Code Velocity San Jose '18

AuthZ Agent Internals AuthZ Agent Open Policy Agent Engine Request Stager Decision API Periodic updates on policies and associated data Updater Velocity San Jose '18

Example Setup Report Authorization Policy Generator 1. Employees can read their own salary and the salary Payroll Service of anyone who reports to /getSalary/* /getSalary/alice Alice them. /getSalary/bob AuthZ Agent Report Generator Job 2. GET should be able to Read all /getSalary/{user} /getSalary/bob users' salaries App Bob Code POST Performance Review 3. /updateSalary/{user} Application should be able to update all users' salaries Performance /updateSalary/* Review Velocity San Jose '18

Open Policy Agent @OpenPolicyAgent @sometorin

What about RBAC? @OpenPolicyAgent @sometorin

RBAC solves XX% of the problem. @OpenPolicyAgent @sometorin

"Restrict employees from accessing "Allow all HTTP requests the service outside of work hours." from 10.1.2.0/24." "Restrict ELB changes to senior "QA must sign-off on images SREs that are on-call." deployed to the production namespace." "Analysts can read client data but PII must be redacted." RBAC is not enough. "Give developers SSH access to machines listed in JIRA tickets assigned to them." "Prevent developers from running containers with privileged security contexts in the production namespace." "Workloads for euro-bank must be deployed on PCI-certified clusters in the EU." @OpenPolicyAgent @sometorin

Service Policy Policy Query Decision OPA is a general-purpose OPA policy engine. Data Policy (JSON) (Rego) @OpenPolicyAgent @sometorin

Service Enforcement Policy Policy Query Decision Decisions are decoupled OPA from enforcement. Data Policy (JSON) (Rego) @OpenPolicyAgent @sometorin

Node Service OPA Evaluate policies locally. ● Daemon (HTTP API) ● Library (Go) ● Service Mesh (Istio) Node Service OPA @OpenPolicyAgent @sometorin

Node Node Fate Sharing ✔ Low latency Service Service OPA OPA ✔ High availability Node Node Host Failures Service OPA Network Node Node Network Partitions Service OPA Network @OpenPolicyAgent @sometorin

Service Policy and data are Policy Policy Query Decision stored in-memory. OPA No external dependencies during enforcement. Data Policy (JSON) (Rego) @OpenPolicyAgent @sometorin

Service Policy Policy Query Decision Declarative Language (Rego) OPA ● Is Identity I allowed to perform Operation O on Resource R? ● What labels must applied to Deployment X? ● Which users can SSH into production servers? Data Policy (JSON) (Rego) @OpenPolicyAgent @sometorin

"Employees can read their own salaries and the salaries of their subordinates." @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input {"method": "GET", "path": ["salaries", "bob"], "user": "bob"} @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input allow = true { input.method = "GET" {"method": "GET", "path": ["salaries", "bob"], input.path = ["salaries", employee_id] "user": "bob"} input.user = employee_id } @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input allow = true { input.method = "GET" {"method": "GET", "path": ["salaries", "bob"], input.path = ["salaries", "bob"] "user": "bob"} input.user = "bob" } @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input allow = true { input.method = "GET" # OK {"method": "GET", "path": ["salaries", "bob"], input.path = ["salaries", "bob"] # OK "user": "bob"} input.user = "bob" # OK } @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input allow = true { input.method = "GET" {"method": "GET", "path": ["salaries", "bob"], input.path = ["salaries", employee_id] "user": "alice"} input.user = employee_id } "alice" instead of "bob" @OpenPolicyAgent @sometorin

"Employees can read their own salaries [...]" Input allow = true { input.method = "GET" # OK {"method": "GET", "path": ["salaries", "bob"], input.path = ["salaries", "bob"] # OK "user": "alice"} "alice" = "bob" # FAIL } "alice" instead of "bob" @OpenPolicyAgent @sometorin